Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other.

One way to do this is to simply copy A's cert over to B's allowed cert list and vice versa, but this is a little cumbersome usability-wise.

Instead, what about this scheme:

  1. Device A generates a key K that it remembers for a short period of time
  2. The user copies K and enters it in, along with device A's hostname, on device B
  3. Device B makes a TLS connection to device A and includes its client cert
  4. Device B sends message m1 = HMAC(K, "request" + its client cert + observed server cert)
  5. Device A checks that m1 looks like what it expects, if not, it closes the connection
  6. Device A responds with m2 = HMAC(K, "response" + observed client cert + its server cert) and adds device B's cert to its trusted list
  7. Device B checks that m2 looks correct, and if so, adds device A's cert to its trusted list.

Is this secure, and if so, how short can K be?

  • $\begingroup$ What particular attacks do you want it to be secure from? Also, is there a reason you can't simply transmit the certificate blindly and securely exchange the fingerprint, trusting the cert if the fingerprint matches? $\endgroup$
    – forest
    Sep 4 '19 at 2:21
  • $\begingroup$ I'm concerned about man-in-the-middle attacks specifically, so the point is how to securely exchange fingerprints in the first place. $\endgroup$
    – Ben
    Sep 4 '19 at 21:45
  • $\begingroup$ You can not protect against MITM attacks without any pre shared knowledge, starting just from self-signed certificates. However, most devices have pre shared knowledge in form of certificates installed into the systems (e.g. certificates from a PKI, or a "trusted" public channel). $\endgroup$
    – Fleeep
    Sep 5 '19 at 8:17

This is fine. There is one corner case I would note which is that the message from 4 can be replayed in 6. So the authenticated messages should include an indication of whether they are for step 4 or 6. As for how short K can be: as long as necessary to get the guarantee you want from HMAC.

  • $\begingroup$ Thanks, Lily. Note that in step 4, I have the string "request" and in step 6 I have the string "response" to prevent the replay you describe. $\endgroup$
    – Ben
    Jan 3 '20 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.